expected result

rm -rf data/*; /usr/bin/java -Djava.io.tmpdir=/opt/logs/logstash/tmp -jar /opt/logs/logstash/bin/logstash.jar agent -f /opt/logs/logstash/conf/logstash.conf 
2013-10-18 03:00:14,993 - Module.special - DEBUG - search_aa - end in - 183
2013-10-18 03:00:14,993 - Module.special - DEBUG - search_bb - stop in - 112
{
       "message" => "2013-10-18 03:00:14,993 - Module.special - DEBUG - search_aa - end in - 183",
    "@timestamp" => "2013-10-18T03:00:14.993Z",
      "@version" => "1",
          "type" => "preprod",
      "loglevel" => "DEBUG",
        "action" => "search_aa",
      "duration" => 183,
    "sub_action" => [
        [0] "end",
    ]
}
{
       "message" => "2013-10-18 03:00:14,993 - Module.special - DEBUG - search_bb - stop in - 112",
    "@timestamp" => "2013-10-18T03:00:14.993Z",
      "@version" => "1",
          "type" => "preprod",
      "loglevel" => "DEBUG",
        "action" => "search_bb",
      "duration" => 112,
    "sub_action" => [
        [0] "stop"
    ]
}

logstash.conf

input { stdin { type => 'preprod'}}

filter {
  if [type] == "preprod" {
    

    grok {
      patterns_dir => ['/opt/logs/logstash/src/patterns']

     # log.debug("{} - end in - {}".format(func.func_name, (datetime.now() - time_start).microseconds))
      match => ["message", "20%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{HOUR:hour}:%{MINUTE:min}:%{SECOND:sec},%{POSINT:msec} - Module.special - %{LOGLEVEL:loglevel} - %{WORD:action} - end in - %{POSINT:duration:int}"]
      add_field => ["sub_action", "end"]

      # log.debug("search_cc - cc_found - {} - {}".format(cc, issuer))
      match => ["message", "20%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{HOUR:hour}:%{MINUTE:min}:%{SECOND:sec},%{POSINT:msec} - Module.special - %{LOGLEVEL:loglevel} - %{WORD:action} - stop in - %{POSINT:duration:int}"]
      add_field => ["sub_action", "stop"]

      tag_on_failure      => [ "_bad_1" ]
    }


    mutate {
      replace => [ "date_iso", "20%{year}-%{month}-%{day}T%{hour}:%{min}:%{sec}.%{msec}Z" ]
    }

    date {
      match => ["date_iso", "ISO8601"]
      locale => "fr"
    }

    mutate {
      replace => [ "date_iso", "20%{year}-%{month}-%{day}T%{hour}:%{min}:%{sec}.%{msec}Z" ]
      remove_field => [ "host", "date_iso", "year", "month", "day", "hour", "min", "sec", "msec" ]
    }
  }
}

output { stdout { debug => true } }

RESULT

rm -rf data/*; /usr/bin/java -Djava.io.tmpdir=/opt/logs/logstash/tmp -jar /opt/logs/logstash/bin/logstash.jar agent -f /opt/logs/logstash/conf/logstash.conf 
2013-10-18 03:00:14,993 - Module.special - DEBUG - search_aa - end in - 183
2013-10-18 03:00:14,993 - Module.special - DEBUG - search_bb - stop in - 112
{
       "message" => "2013-10-18 03:00:14,993 - Module.special - DEBUG - search_aa - end in - 183",
    "@timestamp" => "2013-10-18T03:00:14.993Z",
      "@version" => "1",
          "type" => "preprod",
      "loglevel" => "DEBUG",
        "action" => "search_aa",
      "duration" => 183,
    "sub_action" => [
        [0] "end",
        [1] "stop"
    ]
}
{
       "message" => "2013-10-18 03:00:14,993 - Module.special - DEBUG - search_bb - stop in - 112",
    "@timestamp" => "2013-10-18T03:00:14.993Z",
      "@version" => "1",
          "type" => "preprod",
      "loglevel" => "DEBUG",
        "action" => "search_bb",
      "duration" => 112,
    "sub_action" => [
        [0] "end",
        [1] "stop"
    ]
}